Blocked DoS attack?

[byron_hinson]

I seem to have the following in my log all day long and have done for weeks

Fri Apr 7 18:26:07 2006 1 Blocked by DoS protection 10.128.196.1
Fri Apr 7 18:26:11 2006 1 Blocked by DoS protection 10.128.196.1
Fri Apr 7 18:26:20 2006 1 Blocked by DoS protection 10.128.196.1
Fri Apr 7 18:26:37 2006 1 Blocked by DoS protection 10.128.196.1

I have checked out the IP and nothing seems to come back - is this an NTL thing or is it an actual attack and if so - who can I report it to as its been going on for weeks and weeks.

[James Henry]

Originally Posted by byron_hinson

I seem to have the following in my log all day long and have done for weeks

Fri Apr 7 18:26:07 2006 1 Blocked by DoS protection 10.128.196.1
Fri Apr 7 18:26:11 2006 1 Blocked by DoS protection 10.128.196.1
Fri Apr 7 18:26:20 2006 1 Blocked by DoS protection 10.128.196.1
Fri Apr 7 18:26:37 2006 1 Blocked by DoS protection 10.128.196.1

I have checked out the IP and nothing seems to come back - is this an NTL thing or is it an actual attack and if so - who can I report it to as its been going on for weeks and weeks.

You're an MS MVP and don't know what a private (IE non-routable, not part of the internet so not going to have any records on it, RFC1918, etc) IP address looks like?

That's your default gateway, the DoS protection is probably reporting broadcasts that have been stopped. Try a traceroute it'll be the first hop you see.

No actual attack there, if possible exempt it from the DoS protection.

[Paul K]

Looks like someone in your NTL area has got themselves a virus/ trojan or your firewall isn't configured correctly .
You can report suspected problems to the AUP guys at NTL.
http://www.ntlworld.com/helpsupport/aup/index.php

[James Henry]

Originally Posted by Paul

Looks like someone in your NTL area has got themselves a virus/ trojan or your firewall isn't configured correctly .
You can report suspected problems to the AUP guys at NTL.
http://www.ntlworld.com/helpsupport/aup/index.php

It's a 10. address, unless someone's modem is infected it's not a user infection.

[TheBlueRaja]

Yup,
As its a 10.x.x.x address its reserved and has not originated from the Internet, i would suspect something on your network as the obviously knowledgeable James Henry suggests.

Welcome man!

Although byron_hinson not knowing this has no baring on him being an MVP as that can cover a whole swathe of subjects of which networking dosent have to be a requirement.